# IBM i vulnerabilities Source: https://junglewise.ai/threats/technologies/i Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/i.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 120 vulnerabilities in IBM i: 1 in the last 7 days and 42 in the last 90 days, 5 of them critical and 0 exploited in the wild. The most recent, CVE-2026-77153, was published on 8 November 2026. 15 vulnerabilities in the last four weeks, up 67% on the four before (9). 1 critical against 0. ## Counts - Last 7 days: 1 - Last 30 days: 8 - Last 90 days: 42 - All time: 120 (5 critical, 0 exploited in the wild) ## About IBM i IBM i is an operating system designed for IBM Power Systems, integrating a database, middleware, and security features. ## Latest IBM i vulnerabilities - [CVE-2026-77153: IBM i missing authorization in Host-Based Printer Subsystem](https://junglewise.ai/threats/cve-2026-77153-ibm-i-7-6-7-5-7-4-and-7-3-could-allow-a-remote-unauthenticated) (medium, CVSS 4.8, published 8 Nov 2026) - [CVE-2026-93744: IBM i Navigator authentication bypass via improper access control](https://junglewise.ai/threats/cve-2026-93744-ibm-i-7-3-7-4-7-5-and-7-6-could-allow-an-unathenticated-remote) (medium, CVSS 6.5, published 20 Oct 2026) - [CVE-2026-17491: IBM i ChrootDirectory security restriction bypass in OpenSSH](https://junglewise.ai/threats/cve-2026-17491-ibm-i-7-3-7-4-7-5-and-7-6-is-could-allow-a-remote-authenticated) (medium, CVSS 5.4, published 16 Oct 2026) - [CVE-2026-17488: IBM i improper authentication bypass in SST/DST](https://junglewise.ai/threats/cve-2026-17488-ibm-i-7-3-7-4-7-5-and-7-6-could-allow-a-remote-authenticated) (medium, CVSS 4.3, published 16 Oct 2026) - [CVE-2026-17073: IBM i file handle access control vulnerability in NFS](https://junglewise.ai/threats/cve-2026-17073-ibm-i-7-3-7-4-7-5-and-7-6-could-allow-a-local-attacker-to-obtain) (medium, CVSS 5.4, published 16 Oct 2026) - [CVE-2026-17068: IBM i NFS version restriction bypass](https://junglewise.ai/threats/cve-2026-17068-ibm-i-7-3-7-4-7-5-and-7-6-could-allow-a-local-attacker-to-bypass) (medium, CVSS 5.4, published 16 Oct 2026) - [CVE-2026-107674: IBM i Digital Certificate Manager denial of service](https://junglewise.ai/threats/cve-2026-107674-ibm-i-7-3-7-4-7-5-and-7-6-is-vulnerable-to-a-denial-of-service) (medium, CVSS 5.1, published 16 Oct 2026) - [CVE-2026-102917: IBM i privilege escalation in improper privilege management](https://junglewise.ai/threats/cve-2026-102917-ibm-i-7-3-7-4-7-5-and-7-6-is-vulnerable-to-an-authenticated) (high, CVSS 7.8, published 16 Oct 2026) - [CVE-2026-96119: IBM i code injection in HTTP Server Administration](https://junglewise.ai/threats/cve-2026-96119-ibm-i-7-3-7-4-7-5-and-7-6-could-allow-a-remote-authenticated) (critical, CVSS 9.9, published 13 Oct 2026) - [CVE-2026-93886: IBM i cross-site scripting in HTTP Server Administration GUI](https://junglewise.ai/threats/cve-2026-93886-ibm-i-7-3-7-4-7-5-and-7-6-could-allow-a-remote-authenticated) (high, CVSS 8.3, published 13 Oct 2026) - [CVE-2026-81858: IBM i out-of-bounds read in File Server](https://junglewise.ai/threats/cve-2026-81858-ibm-i-7-3-7-4-7-5-and-7-6-could-allow-a-remote-authenticated) (medium, CVSS 5.4, published 13 Oct 2026) - [CVE-2026-18343: IBM i improper privilege management in BOOTP table](https://junglewise.ai/threats/cve-2026-18343-ibm-i-7-3-7-4-7-5-and-7-6-could-allow-a-local-attacker-to-modify) (medium, CVSS 4.4, published 13 Oct 2026) - [CVE-2026-18318: IBM i brute-force attack on authentication in DST/SST](https://junglewise.ai/threats/cve-2026-18318-ibm-i-7-3-7-4-7-5-and-7-6-could-allow-a-remote-attacker-to) (medium, CVSS 5.3, published 13 Oct 2026) - [CVE-2026-17487: IBM i user profile enumeration via sign-on error codes](https://junglewise.ai/threats/cve-2026-17487-ibm-i-7-3-7-4-7-5-and-7-6-could-allow-a-remote-attacker-to) (medium, CVSS 5.3, published 13 Oct 2026) - [CVE-2026-17484: IBM i denial of service in DST/SST due to improper access control](https://junglewise.ai/threats/cve-2026-17484-ibm-i-7-3-7-4-7-5-and-7-6-could-allow-a-local-attacker-to-cause-a) (medium, CVSS 5.3, published 13 Oct 2026) - [CVE-2026-84414: IBM i incorrect permission assignment in Network Authentication Service](https://junglewise.ai/threats/cve-2026-84414-ibm-i-7-6-7-5-7-4-and-7-3-could-allow-a-local-authenticated) (high, CVSS 7.8, published 29 Sep 2026) - [CVE-2026-18869: IBM i FTP server-side request forgery in PORT and EPRT commands](https://junglewise.ai/threats/cve-2026-18869-ibm-i-7-6-7-5-7-4-and-7-3-could-allow-a-remote-authenticated) (medium, CVSS 6.4, published 18 Sep 2026) - [CVE-2026-17262: IBM i FTP authentication denial of service](https://junglewise.ai/threats/cve-2026-17262-ibm-i-7-6-7-5-7-4-and-7-3-could-allow-a-local-attacker-to-cause-a) (medium, CVSS 5.4, published 18 Sep 2026) - [CVE-2026-19280: IBM i buffer overflow in PASE process](https://junglewise.ai/threats/cve-2026-19280-ibm-i-buffer-overflow-in-pase-process) (medium, CVSS 5.2, published 14 Sep 2026) - [CVE-2026-19086: IBM i buffer overflow in PASE process](https://junglewise.ai/threats/cve-2026-19086-ibm-i-buffer-overflow-in-pase-process) (low, CVSS 3.3, published 14 Sep 2026) - [CVE-2026-18069: IBM i race condition in file ownership handling](https://junglewise.ai/threats/cve-2026-18069-ibm-i-race-condition-in-file-ownership-handling) (medium, CVSS 6, published 14 Sep 2026) - [CVE-2026-18251: IBM i WebSocket origin validation bypass](https://junglewise.ai/threats/cve-2026-18251-ibm-i-websocket-origin-validation-bypass) (medium, CVSS 4.3, published 14 Sep 2026) - [CVE-2026-18515: IBM i path traversal in Navigator for i](https://junglewise.ai/threats/cve-2026-18515-ibm-i-path-traversal-in-navigator-for-i) (medium, CVSS 4.3, published 14 Sep 2026) - [CVE-2026-18151: IBM i Navigator race condition in WebSocket handshake](https://junglewise.ai/threats/cve-2026-18151-ibm-i-navigator-race-condition-in-websocket-handshake) (medium, CVSS 4.2, published 14 Sep 2026) - [CVE-2026-18221: IBM i improper authentication validation in DDM/DRDA](https://junglewise.ai/threats/cve-2026-18221-ibm-i-improper-authentication-validation-in-ddm-drda) (high, CVSS 8.1, published 4 Sep 2026) ## Most severe IBM i vulnerabilities - [CVE-2026-16860: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an…](https://junglewise.ai/threats/cve-2026-16860-ibm-i-7-6-7-5-7-4-and-7-3-could-allow-a-remote-authenticated) (critical, CVSS 9.9, published 12 Aug 2026) - [CVE-2026-96119: IBM i code injection in HTTP Server Administration](https://junglewise.ai/threats/cve-2026-96119-ibm-i-7-3-7-4-7-5-and-7-6-could-allow-a-remote-authenticated) (critical, CVSS 9.9, published 13 Oct 2026) - [CVE-2026-17083: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow.](https://junglewise.ai/threats/cve-2026-17083-ibm-i-7-6-7-5-7-4-and-7-3-could-allow-a-remote-attacker-to) (critical, CVSS 9.8, published 12 Aug 2026) - [CVE-2026-17218: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.](https://junglewise.ai/threats/cve-2026-17218-ibm-i-7-6-7-5-7-4-and-7-3-could-allow-a-remote-attacker-to) (critical, CVSS 9.8, published 12 Aug 2026) - [CVE-2026-17276: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to escalate privileges due to improper…](https://junglewise.ai/threats/cve-2026-17276-ibm-i-7-6-7-5-7-4-and-7-3-could-allow-a-remote-authenticated) (critical, CVSS 9.6, published 12 Aug 2026) - [CVE-2026-18193: IBM i security restriction bypass via improper address validation](https://junglewise.ai/threats/cve-2026-18193-ibm-i-security-restriction-bypass-via-improper-address-validation) (high, CVSS 8.9, published 13 Aug 2026) - [CVE-2026-18099: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary script code due to…](https://junglewise.ai/threats/cve-2026-18099-ibm-i-7-6-7-5-7-4-and-7-3-could-allow-a-remote-authenticated) (high, CVSS 8.9, published 12 Aug 2026) - [CVE-2026-17642: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper…](https://junglewise.ai/threats/cve-2026-17642-ibm-i-7-6-7-5-7-4-and-7-3-could-allow-a-remote-authenticated) (high, CVSS 8.8, published 12 Aug 2026) - [CVE-2026-17417: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper…](https://junglewise.ai/threats/cve-2026-17417-ibm-i-7-6-7-5-7-4-and-7-3-could-allow-a-remote-authenticated) (high, CVSS 8.8, published 12 Aug 2026) - [CVE-2026-16906: IBM i 7.6, and 7.5 could allow a remote authenticated attacker to execute arbitrary commands with elevated privileges…](https://junglewise.ai/threats/cve-2026-16906-ibm-i-7-6-and-7-5-could-allow-a-remote-authenticated-attacker-to) (high, CVSS 8.8, published 12 Aug 2026) ## Vulnerabilities per week 15 vulnerabilities in the last four weeks, up 67% on the four before (9). 1 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 18 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 8 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 1 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 13 | 1 | 0 | | 19 Oct 2026 | 1 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 1 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other IBM technologies - [IBM API Connect](https://junglewise.ai/threats/technologies/api-connect): 207 vulnerabilities - [IBM AIX](https://junglewise.ai/threats/technologies/aix): 181 vulnerabilities - [IBM Langflow](https://junglewise.ai/threats/technologies/langflow-oss): 154 vulnerabilities - [IBM Guardium Data Protection](https://junglewise.ai/threats/technologies/guardium-data-protection): 93 vulnerabilities - [IBM PowerVM VIOS](https://junglewise.ai/threats/technologies/powervm-vios): 73 vulnerabilities - [IBM Vios](https://junglewise.ai/threats/technologies/vios): 72 vulnerabilities - [IBM WebSphere Application Server](https://junglewise.ai/threats/technologies/websphere-application-server): 67 vulnerabilities - [IBM WebSphere Application Server Liberty](https://junglewise.ai/threats/technologies/websphere-application-server-liberty): 56 vulnerabilities - [IBM Verify Identity Access](https://junglewise.ai/threats/technologies/verify-identity-access): 50 vulnerabilities - [IBM Datastage On Cloud Pak For Data](https://junglewise.ai/threats/technologies/datastage-on-cloud-pak-for-data): 48 vulnerabilities - [IBM Mq](https://junglewise.ai/threats/technologies/mq): 46 vulnerabilities - [IBM Financial Transaction Manager](https://junglewise.ai/threats/technologies/financial-transaction-manager): 45 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "IBM i vulnerabilities", https://junglewise.ai/threats/technologies/i, 12 November 2026.